Threat database

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

The MediaWiki PageTriage extension versions 1.43, 1.45, and 1.46 contain a vulnerability that exposes sensitive information through data queries. This issue is classified under CWE-202, which involves exposure of sensitive information through data queries. The vulnerability has a low severity rating and a CVSS 4.0 score of 1.2. There is no indication of known exploits in the wild or available patches at this time.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikbase extension versions 1.43, 1.45, and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, classified as CWE-80. It allows an attacker to inject script code into web pages, potentially impacting users with high privileges who interact with the affected extension. The vulnerability has a low CVSS score of 0.3 and no known exploits in the wild.

A low-severity Cross-Site Scripting (XSS) vulnerability exists in the MediaWiki Wikistories extension versions 1.43, 1.45, and 1.46. The issue is due to improper neutralization of script-related HTML tags, which can allow script injection in web pages. This vulnerability is identified as CWE-80. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

A reflected cross-site scripting (XSS) vulnerability exists in the MediaWiki ReadingLists extension versions 1.45 and 1.46. This vulnerability is due to improper neutralization of script-related HTML tags, which can allow an attacker to inject malicious scripts into web pages. The issue has a low severity rating and a CVSS 4.0 score of 1.1. No official patch or remediation guidance has been provided yet.

CVE-2026-103446 is an authorization bypass vulnerability in the Wikimedia Foundation's MediaWiki WikiLambda extension version 1.46. It involves a user-controlled key that allows authentication bypass, potentially enabling unauthorized access. The vulnerability has a high severity with a CVSS score of 7.4. A patch is available for this issue. The affected product is a cloud service, and the vendor manages remediation for this service.

A stored cross-site scripting (XSS) vulnerability exists in the MediaWiki Page_Forms extension maintained by The Wikimedia Foundation. The flaw is due to improper neutralization of script-related HTML tags, allowing malicious scripts to be stored and executed in the context of affected web pages. This vulnerability affects specific versions 1.43, 1.45, and 1.46 of the extension. The CVSS 4.0 base score is low, indicating limited impact and exploitability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-103444 is a low-severity stored cross-site scripting (XSS) vulnerability in the MediaWiki WikiForum extension maintained by The Wikimedia Foundation. It involves improper neutralization of script-related HTML tags, allowing potentially malicious scripts to be stored and executed in the context of the affected web pages. The vulnerability affects the master branch of the WikiForum extension. No specific affected versions or patch information is provided.

A low-severity cross-site scripting (XSS) vulnerability exists in the MediaWiki Collection (Book) extension versions 1.43, 1.45, and 1.46. The issue involves improper neutralization of script-related HTML tags, allowing XSS targeting non-script elements. This vulnerability could potentially allow an attacker to inject malicious scripts into web pages generated by the affected extension versions.

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

CVE-2026-103044 is a critical XML injection vulnerability, also known as blind XPath injection, in the Mediawiki EasyTimeline extension maintained by The Wikimedia Foundation. This flaw allows attackers to inject malicious XML content, potentially impacting confidentiality, integrity, and availability. The vulnerability affects versions before 1.43.10, 1.45.5, and 1.46.1 of the EasyTimeline extension. It has a high CVSS score of 9.8, indicating severe risk if exploited.

CVE-2026-102796 is a high-severity SQL Injection vulnerability in the Wikimedia Foundation's Mediawiki UserPageViewTracker Extension. It affects multiple versions prior to 1.46.1, 1.45.5, and 1.43.10. The flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to unauthorized disclosure of data but does not impact integrity or availability according to the CVSS vector.

CVE-2026-100242 is a high-severity vulnerability in the Wikimedia Foundation Mediawiki DataTransfer Extension. It involves a dependency on a vulnerable third-party component that leads to uncontrolled resource consumption, specifically excessive memory allocation. The issue affects versions from 1.46.0 up to but not including 1.47.0 of the DataTransfer Extension.

CVE-2026-100240 is a critical missing authorization vulnerability in the Wikimedia Foundation's Mediawiki TemplateSandbox Extension. It allows unauthorized access to functionality that is not properly constrained by access control lists (ACLs). The vulnerability affects multiple versions of the TemplateSandbox Extension prior to 1.46.1, including specific ranges 1.43.0 to before 1.43.10 and 1.45.0 to before 1.45.5.

A Cross-Site Scripting (XSS) vulnerability exists in the Wikimedia Foundation Mediawiki WikiLambda Extension version 1.47.0-alpha. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The issue has been fixed in the master branch of the codebase.

CVE-2026-100382 is a critical OS Command Injection vulnerability in the Wikimedia Foundation's Mediawiki ExternalData Extension. It affects all versions prior to 3.7. The flaw allows improper neutralization of special elements used in OS commands, potentially enabling remote attackers to execute arbitrary OS commands without authentication.